Merge "Except the shell domain from the transition neverallow rule."

app.te

@@ -205,7 +205,8 @@ neverallow { appdomain -unconfineddomain } { domain -appdomain }:process
     { sigkill sigstop signal };
 
 # Transition to a non-app domain.
-neverallow { appdomain -unconfineddomain } ~appdomain:process
+# Exception for the shell domain, can transition to runas, ping, etc.
+neverallow { appdomain -shell -unconfineddomain } ~appdomain:process
     { transition dyntransition };
 
 # Map low memory.